wiki-research-loop
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches research data from well-known services including arXiv (export.arxiv.org), GitHub (api.github.com), and DuckDuckGo (lite.duckduckgo.com). This behavior is consistent with the skill's stated purpose.
- [COMMAND_EXECUTION]: The main driver
scripts/research-loop.jsprovides a command-line interface for managing the research process and interacting with the local database. - [PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks. Ingestion points: Data is collected from external websites via plugins in
scripts/source-fetchers/. Boundary markers: None are used; the skill inserts extracted claims directly into markdown files without isolation. Capability inventory: The skill can perform file system writes and database updates. Sanitization: No content validation or sanitization is performed on the fetched text beyond basic formatting.
Audit Metadata